Australian Attorney General Wants To Make It A Criminal Offense To Not Turn Over Private Encryption Keys
from the a-disaster-waiting-to-happen dept
The Attorney-General’s department in Australia is apparently pushing for new laws down under that would force anyone who’s asked to hand over their private encryption keys — and that covers both end users and service providers. Buried in the middle of a submission concerning revising Australia’s wiretapping laws, the AG’s office notes:
The Department is also advised that sophisticated criminals and terrorists are exploiting encryption and related counter-interception techniques to frustrate law enforcement and security investigations, either by taking advantage of default-encrypted communications services or by adopting advanced encryption solutions.
The Department’s current view is that law enforcement, anti-corruption and national security agencies should be permitted to apply to an independent issuing authority for a warrant authorising the agency to issue ‘intelligibility assistance notices’ to service providers or other persons. The issuing authority should be permitted to impose conditions or restrictions on the scope of this authority.
[….]
Under this approach, the person receiving a notice would be required to provide ‘information or assistance’ to place information obtained under the warrant into an intelligible form. The person would not be required to hand over copies of the communication in an intelligible form, and, a notice would not compel a person to do something which they are not reasonably capable of doing. Failure to comply with a notice would constitute a criminal offence, consistent with the Crimes Act.
The above approach is consistent with the approach taken by the United Kingdom, which permits officials of law enforcement and national security agencies to, where authorised under a warrant, issue a notice requiring a person to provide assistance in connection with accessing encrypted communications. Similarly, South African law permits agencies to apply to a judicial officer for a direction requiring a person to provide information to the agency to enable the agency to decrypt lawfully intercepted communications.
The Orwellian nature of “intelligibility assistance notices” is fairly striking. Basically, this says if you don’t make encrypted communication “intelligible” upon request, you would have violated criminal law. It’s kind of funny how it claims this doesn’t require anyone to hand over communication in an intelligible form… because it just asks for the encrypted content and the key to decrypt them. Which, you know, is basically the same damn thing.
Meanwhile, at the same time as part of the same discussion over wiretapping laws, there’s an effort under way in Australia to force service providers into a big data retention scheme, forcing them to hold onto all sorts of data for law enforcement purposes. Incredibly, Australian officials seem to be using the NSA/Snowden leaks as the impetus for this.
Intelligence agency ASIO is using the Snowden leaks to bolster its case for laws forcing Australian telecommunications companies to store certain types of customers’ internet and telephone data for a period of what some law enforcement agencies would like to be two years.
ASIO also, like the AG’s office, seems quite concerned about you damn kids and all your encrypting:
“Since the Snowden leaks, public reporting suggests the level of encryption on the internet has increased substantially,” ASIO said.
“In direct response to these leaks, the technology industry is driving the development of new internet standards with the goal of having all web activity encrypted, which will make the challenges of traditional telecommunications interception for necessary national security purposes far more complex.”
So, even if everything’s getting encrypted, certain law enforcement interests seem hell-bent on having everything collected and easy (forced) availability of private keys. If you happen to live in Australia, you might want to speak up about what’s about to happen to what you thought were your private communications and browsing activity.
Filed Under: asio, attorney general, australia, data retention, encryption, privacy, wiretapping
Comments on “Australian Attorney General Wants To Make It A Criminal Offense To Not Turn Over Private Encryption Keys”
Here in America...
We have the 5th which protects us left and right regarding this stuff.
O wait… I keep forgetting, we HAD a constitution but it got flushed after someone took a shit.
Re: Here in America...
In Australia, the water would have rotated in the other direction…
Re: Re: Here in America...
That’s a myth! It rotates upside down!
Re: Re: Re: Here in America...
That would be very messy if you think about it…
Re: Here in America...
Why respect their laws, if they dont respect yours
Let them call me a criminal for daring to indulge the thought of not following their laws, while i point out that they are already ignoring ours
The natural law vs Manufactured laws
Re: Here in America...
well in Aussie land which seems to be full of redneck morons anyway; there never was a 5th; or a 1-4. what yltheyve got is some document written by a bunch of sheep herders….
try that for democracy…
Ephemeral keys
That’s the reason for ephemeral key schemes (DHE, ECDHE, OTR): once the communication is finished, the key is discarded and nobody can decrypt the communication anymore. Not even the sender or the receiver.
It’s no surprise that there has been a stronger focus on increasing the use of ephemeral key schemes.
Re: Ephemeral keys
The problem with this idea is often one needs to reread the message/document at a later date. This need could lead to a situation where one reencrypts the plain text using a permanent key.
I often wonder if most people would be better with a very strong log on password and no encryption. Some would need to encrypt selected files such as lawyer-client communications. Given the technical competence of most police departments, a strong password would stop them could. It would never occur to them to use a Linux live CD/DVD to view the files.
Re: Re: Ephemeral keys
“I often wonder if most people would be better with a very strong log on password and no encryption.”
No, they wouldn’t. It might (but likely wouldn’t) stop spies from logging on, but it will do nothing to protect you against the more prevalent threat of having your communications eavesdropped on.
Re: Re: Re: Ephemeral keys
oggod; everyone knows there’s no firewall that can stop nsa CIA or asio. and its most of their agents that are using silk road…..
u might as well leave your mobile/laptop on the street for anyone to look at. I’ve given.up on privacy. my phones hacked constantly daily ….
Re: Re: Ephemeral keys
That’s for data “at rest”. The bad idea mentioned in this article is about communications, not data at rest.
There is no need to reread communications. Once it arrives at its destination, its key can be discarded without issue. By their nature, communications are ephemeral, which is why ephemeral keys work well.
Yes, once at the destination, you should re-encrypt whatever you received with a permanent key, if you want to keep a copy. Or the sender could have already encrypted it for you with a permanent key, while still protecting it with an outer ephemeral key. There are other bad laws that force you to reveal your permanent key, but again this is not what this article is about; and you might have the option of not saving the message, thus avoiding these laws.
Re: Re: Ephemeral keys
Nobody should listen to this, it is completely naive and very stupid to think that the law would not be able to access a system protected by only a logon password.
Encryption is the way forward and if you have anything you need to protect, regardless of the content you should always use a strong encryption. Why do you think TrueCrypt has ceased development? It’s likely because it is reliable in most cases.
In lieu of encryption
One could always write their stuff in plain text, expecting to be listened in upon. No one would ever expect there to be misinformation included.
Still better than the US
This is a terrible thing, but at least they say they are planning on requiring Warrants. The US forgot our Constitution requires Warrants, specifically to prevent what they’ve been doing.
The Department?s current view is that law enforcement, anti-corruption and national security agencies should be permitted to apply to an independent issuing authority for a warrant authorising the agency to issue ?intelligibility assistance notices? to service providers or other persons. The issuing authority should be permitted to impose conditions or restrictions on the scope of this authority.
…
Under this approach, the person receiving a notice would be required to provide ?information or assistance? to place information obtained under the warrant into an intelligible form.
The people’s current view is that citizens should be permitted to apply to an independent issuing authority for a warrant authorising the citizen to issue ‘intelligence assistance notices’ to political representatives or other government officials. The issuing authority should be permitted to impose conditions or restrictions on the scope of this authority.
…
Under this approach, the person receiving a notice would be required to provide ?evidence of their intelligence? to explain the incredibly bad ideas they have proposed in an intelligible form.
Why do you think...
That Australia’s having protests over their government right now?
Keys
They won’t ever get my encryption keys, since those are used to protect my clients’ attorney-client privileged documents. My duty to my clients comes first.
Re: Keys
Don’t worry. We already have yours.
– NSA
any way of finding out who this ‘person’ is working for, who is putting him up for this and the other changes he wants? it obviously isn’t the Australian people, as he is trying to turn the country into another model of the USA where everyone is fair game and no one is allowed to have any secrets!! you can bet what you like which industry is behind this! the self same one that wants full control of the internet and will stop at nothing to get it or to penalise those who use it to get copyrighted files!!
Re: Re:
I’m fairly certain the Australian AG is appointed, not elected, so he does not actually work for the people.
Re: Re: Re:
Sorta.
The AG is a member of parliament (i.e. voted into the legislature’s upper or lower house in a general election) appointed by the Governor General upon advice of the Prime Minister.
So the AG’s position is not directly voted on, but the AG must be appointed out of the pool of people voted into the legislature in a general (or by-) election.
Re: Re: Re:
The Attorney General (Federal) is an appointed role that is appointed by the Federal cabinet using an ELECTED member from that cabinet.
In this instance the AG is Senator George Brandis QC who is an elected senator for the State of Queensland and has been a lawyer (Solicitor then Barrister then Queens Counsel) since 1985.
George is actually a very well known and brilliant lawyer though he has negligible experience with criminal law since his practice was entirely devoted to civil. Which realistically doesn’t mean squat as the AG since he has a multitude of minions working for the Department who really do all the work and he just spews forth their IDIOTIC recommendations.
As for this recommendation, it’s idiotic, bypasses all procedural fairness (especially since it’s NOT using a court to issue warrants but an external ‘independent’ -HA FUCKING HA – issuing authority) and is unworkable with so many chilling effects. If it gets passed the High Court case and subsequent hammering of the unconstitutionality of the thing will be highly enjoyable to watch.
Re: Re: Re: Lawyers and Technology generally don't mix
Senator Brandis may be a “brilliant” lawyer, but in my experience, lawyers are technological imbeciles. I have already spoken to my member about the incompetency of the current Attorney General in relation to technological matters. Interestingly, though he said nothing against the man, which shows my member’s good sense, one did get the picture that the Attorney General may not have been his most favourite fellow parliamentarian (they are of the same political party). He did say something similar about the minions.
One has to remember that the vast majority of lawyers think that the only solution to any problem is making a new law. It’s the old adage about only having a hammer and everything looking like a nail.
Lastly, Senator Brandis being a QC essentially means that you do not want to have anything to do with him. The general rule of thumb for any business that provides services of any kind is to avoid doing any business with lawyers, especially barristers and QC, as you won’t get paid for your efforts or if you do, it will have cost you many times more the amount paid.
Lawyers (especially barristers and QC’s) here have a basic reputation that is worst than used car salesmen for may people.
Re: Re: Re:2 Lawyers and Technology generally don't mix
Brandis is basically a technology noob, I never said differently, and if you want a Senator that actually has anything like a CLUE in the current Senate (and hopefully in next depending on how WA goes) then Scott Ludlum is the ONLY bet at the moment.
Sadly the above policy is NOT the only idiotic submission that has been put forth due to the actual Senate inquiry into the TIA (Telecommunications Interception & Access Act) put forth by the Greens with an emphasis on internet surveillance. The other stupidities are:
* data retention provisions (that were rejected by parliament already) to be part of a new TIA .WTF!!!!!!!!
* The NT Police (as if they don’t have enough problems already) called for EVERYONE’S browsing history to be logged so it can be used in investigations for them (or anyone)
* The AFP and ASIO (+ other acronyms) have asked for hugely expanded data retention and surveillance powers that bypass standard procedural fairness doctrines.
* though ironically all areas of government(s) all state that privacy is IMPORTANT (Though that could be because the new Aust Privacy principles came into effect on 12th March) but only when it doesn’t suit there own mandates.
Actually the full list of submissions is fascinating reading as to whom is actually wanting what etc etc. http://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Legal_and_Constitutional_Affairs/Comprehensive_revision_of_TIA_Act/Submissions
Re: Re: Re:3 Lawyers and Technology generally don't mix
PS: Your last statement about Barristers & QC’s is only sometimes correct. And realistically not many people actually know what a QC, SC ( Senior Counsel), or even a barrister actually is let alone the distinction between them and a standard Solicitor.
In actuality most people think of “The Castle” when they think of QC’s. Thankfully I don’t practice (though I hold an LLB) so don’t have to worry about what people think of me in that area.. I already know I’m an arsehole 🙂
Re: Re: Re:
the Australian AG is both elected and appointed.
as a member of parliament (lower house) the group of pollies with the most members elected get to form government, the leader of this group becomes prime minister (the head of government). the prime minister appoints other elected members to government ministries like the Attorney General.
This wanker is both Attorney General & Minister for the Arts, the proposal last week on copyright reeked of conflict of interest.
Who wants to bet that NSA/US gov is behind this? They know a lot more people are now interested in protecting themselves, so they are pushing all of their allied countries to adopt laws immediately making it a crime to properly encrypt your content.
It’s Orwellian and disgusting. This is the stuff that makes for violent revolutions. We’ve had so many revolutions in the world lately, and some leaders still don’t want to learn from others’ mistakes, and push through with this.
What’s driving the current push towards increased encryption is the knowledge that certain governments are more than willing to compromise their citizen’s expectations of privacy and trust, NOT the tech sector. And as for making your job more complex than tapping cables and listening to unencrypted conversations? Too. Fucking. Bad.
Re: Re:
You want my password to decrypt? No problem! It’s “GovSuxDballz69”. What’s that you say, it’s not working? You must not be typing it in correctly. Just keep on trying and if it still doesn’t work… well I’m no tech expert, but my guess would be you screwed something up. No, that really is my password. Honest! 😉
Just implement a data decryption protocol that allows you to enter a “fake” passsword that trashes the data and/or shows irrelevant info such as public domain content. If you do the latter, they may be tricked into thinking that it was the only thing being protected.
Then, invoke the 5th when it comes to whether that is the legit content, no matter if it is or isn’t.
Re: Re:
Trashing the data is useless. Every forensic analyst worth his salt will do all their work on a copy.
Systems that have more than one password with different contents for each already exist; truecrypt is one of them.
Re: Re: Re:
TrueCrypt is great and I’ve been using it since v4, primarily for security against theft. My OS drive is fully encrypted, as well as my 12 TB data center and backup drives as well.
The key is to backup those headers and all your important data from time to time. Otherwise you run the risk of losing it all permanently when you do something dumb.
Oh and always use a password you’ll remember even if you don’t use it for 6+ months, yet isn’t easily guessed either. Learned that the hard way lol.
Re: Re:
We do not have “the 5th” in Australia..
As for the ‘salted earth’ password technique… That’s an old method and basically creates a new criminal offense anyway. Always has since you are intentionally destroying evidence, unles you can prove that you had no reasonable knowledge that ‘password’ would do such a thing. Onus is on the informant to prove their non intent.. good luck with that one
Subtle as a sledgehammer
I’m surprised they didn’t just come out and openly say ‘We strongly believe that privacy, for those not in power, is a privilege, not a right, and anyone who disagrees with us is welcome to argue their case from behind bars’.
But but but
“Intelligence agency ASIO is using the Snowden leaks to bolster its case for laws forcing Australian telecommunications companies to store certain types of customers’ internet and telephone data for a period of what some law enforcement agencies would like to be two years.” –
Amerika did it so why cant we?
Re: But but but
Using the Snowden leaks to “bolster its case” is really odd. If anything you’d think doing so would weaken their case.
he’s doing well! he hasn’t been in the job 5 minutes and look at all the shit he’s kicking up! i wonder where he’s getting his orders from?
Not the same damn thing at all
It’s not the same damn thing at all. It’s worse.
There’s a fundamental difference between handing over decrypted content, and handing over encrypted content plus the key. When somebody hands over their key, it allows you to read not only the encrypted content you asked for but also any other encrypted communications you may have intercepted.
This is most notable because the policy is specifically stated to apply to service providers. As an example, a single investigation of a single Facebook user would allow the investigators to grab a copy of Facebook’s private SSL certificate. Once they had that certificate, the investigators could read any Facebook traffic sent to or from any user over HTTPS.
This is carefully phrased to the extent that I suspect it’s by design. If this were passed into law, it would fundamentally compromise not only SSL, but pretty much all current asymmetric-key cryptography.
Re: Not the same damn thing at all
“When somebody hands over their key, it allows you to read not only the encrypted content you asked for but also any other encrypted communications you may have intercepted.”
This would only be true if you’re using some brain-dead system that shares the same crypto key amongst all communications. If yours does this, you need to change to something better immediately.
Re: Re: Not the same damn thing at all
Brain-dead like PKCS#1? PGP / GPG? SSL?
This law would affect anything that uses asymmetric keys. If Alice encrypts her message with your public key, and you’re required to hand over her encrypted message plus the means of decrypting it, then they’re asking for your private key. Giving them your private key is worse than giving them the decrypted message.
I suspect that what you’re trying to say is that most modern crypto systems use key exchange algorithms to generate transient per-session or per-message keys. This is true. But by design, those transient keys are never saved. Even writing those keys to disc means that you’re doing it wrong.
As I said in my original post, the AG’s submission was made using very careful phrasing. I doubt anyone in the AG’s office wants a service provider to hand over, say, a raw dump of encrypted TCP/IP packets plus the generated key from a Diffie-Hellman algorithm. What it does sound like, at least to me, is that they’re trying to get a legal way to harvest private keys.
Re: Re: Re: Not the same damn thing at all
You only have and use one private key for everything?
Re: Re: Re:2 Not the same damn thing at all
If you’re setting up a website that uses HTTPS, do you generate (and get signed) multiple private/public keypairs for its certificate? Do you generate a new GPG key for every individual you communicate with? If you use a VPN, do you use that VPN for only one kind of traffic with a single recipient? Do you create a new bitcoin wallet for every transaction?
For almost everybody, the answer would be “no”.
Re: Re: Re:3 Not the same damn thing at all
Re: Re: Re: Not the same damn thing at all
For PGP and similar protocols you might be in compliance if you handed over the ephemeral symmetric key(s) for each of the messages concerned. If you have the encrypted message, you can still use your private key to decrypt the session key, and give them that.
Of course, that means you know which messages they’re reading, so they would probably change the rules pretty promptly after they figure that out.
Re: but also any other encrypted communications you may have intercepted.
Not necessarily.
be afraid, very afraid
I live in Oz and I do have to say that unfortunately speaking up is unlikely to have much effect on our new AG who is perceived as a particularly nasty and vindictive man.
Since coming into office he has so far:
Authorised a raid on a Lawyers office in clear breach of attorney/client priviledge that was solely designed to intimidate a witness (highly ranked Intelligence officer, whistleblower) who was about to appear in the Hague to testify about illegal spying by our Gov during sensitive negotiations with East Timor. They confiscated the evidence and the passport of the wintess under “National Security” guise. Sound familiar? In reality, the evidence would have seriously embarrassed a number of the AG’s colleagues who were in power at the time
Indicated he is looking to make ISP’s liable for the actions of their users. Was not to happy with the Supreme Court decision re. iinet (search Techdirt if you want more info) so wants to change laws to suit.
Wants to repeal racial vilification laws to appease Rupert Murdoch’s media interests in the name of free speech….. then in the same breath, as our Arts Minister decides that a bunch of artists who exercised their own free speech rights by declining sponsorship for a festival from a company employed by our Gov in the handling of refugees (very controversial topic here) should be forced to accept sponsorship.
This is despite the fact that there are laws in place that quite explicitly state that Arts Minster is not permitted to attempt to interfere with the independent body that handles Arts Funding. He has already stated he is just going to ignore the law and force the body to comply.
This is our AG. If there are laws in place that may inconvenience his party or their rich backers, he just either ignores them or wants to force through changes without following any kind of due process. And this is the man responsible for enforcing our own laws.
Make your own judgement.
Re: be afraid, very afraid
I see there’s, so far, no mention of this latest crap from Brandis in Rupert or Gina’s lamestream media. He’s not enforcing our laws (I’m almost ashamed to call myself an Australian) he’s there to enforce the corporate laws and set himself up for a cushy lobby job when he gets the chop. As the old adage (slightly paraphrased) goes: The LNP, the best government that corporate money can buy.
Re: be afraid, very afraid
And in any case. It is already an offense here in Victoria not to supply encryption keys, if a warrant has been provided. This is Australia, we have no 5th, 4th or 1st here.
Re: Re: be afraid, very afraid
Providing encryption keys that actually work though is another matter entirely since the subpoena has been fulfilled if any reasonably key is provided.
Been there, gone through that ambiguous bullshit from both sides of evidence collection under that legislation. Also the subpoena/warrant is authorised by a Court (Local/Magistrate or District normally) and NOT by some other non trier of facts body set up for that express purpose (ie:tribunal) as the AG want in this matter.
Yeppers, we don’t even have Freedom of Speech per say here though we definitely have an equivalence to the 4th amendment under Procedural Fairness Doctrines of all courts and other criminal investigative statutory powers of LEO’s.
As for the 5th.. well the equivelant of Miranda Warning is all over Australia and you have the ability NOT to answer any questions by Police (other than in very controversial situations that haven’t really been tested like terrorism matters) and the best advice any solicitor would give any client is “when in doubt SHUT UP.. If you don’t understand that answer SHUTUP.. if you don’t shutup then your a problem to yourself”